Most recent entries from all

ALSA-2026:4012 — Moderate: kernel security update

Affected: AlmaLinux:10: kernel-abi-stablelists, AlmaLinux:10: kernel-doc

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141) * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free (CVE-2025-38106) * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703) * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760) * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818) * kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service (CVE-2025-40249) * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085) * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001) * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097) * kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation (CVE-2026-23156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-10187

BELL-CVE-2025-40249

Affected: Alpaquita:stream: linux-lts

certfr-2026-avi-0330 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un…

certfr-2026-avi-0330

EUVD-2026-347390

fkie_cve-2025-40249

In the Linux kernel, the following vulnerability has been resolved:

gpio: cdev: make sure the cdev fd is still active before emitting events

With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier.

Using the regular get_file() routine in this situation triggers the following warning:

struct file::f_count incremented from zero; use-after-free condition present!

So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.

GHSA-p8p4-x362-gp65

In the Linux kernel, the following vulnerability has been resolved:

gpio: cdev: make sure the cdev fd is still active before emitting events

Using the regular get_file() routine in this situation triggers the following warning:

struct file::f_count incremented from zero; use-after-free condition present!

So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.

RHSA-2026:4012 — Red Hat Security Advisory: kernel security update

kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting kernel: drm/xe: Make dma-fences compliant with the safe access rules kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() kernel: macvlan: fix possible UAF in macvlan_forward_source() kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation

UBUNTU-CVE-2025-40249

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 106 more

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released.

WID-SEC-W-2025-2747 — Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder weitere, nicht spezifizierte Auswirkungen zu erlangen.